LPM CLI

lpm is a single Rust binary that talks to the lpm.dev registry, manages your encrypted secrets vault, exposes local services through LPM tunnels, and resolves/installs packages from any npm-compatible source. It's not a wrapper around npm — it's the package manager.

Install

npm install -g @lpm-registry/cli

The npm package downloads a platform-native binary on install. Other channels (Homebrew, curl installer, cargo install) are listed under Installation.

Quick start

lpm login                                # sign in via browser
lpm setup-npmrc                          # 30-day read-only token for `npm install`
lpm install @lpm.dev/acme.utils          # install from lpm.dev
lpm env set DATABASE_URL=...             # write to the local secret vault
lpm tunnel 3000                          # expose localhost for webhook dev
lpm publish                              # publish the current directory

What's in scope on lpm.dev/docs

These pages cover the parts of the CLI that interact with the lpm.dev registry and platform:

  • Commands — registry-focused command reference (auth, publish, install, env, tunnel, marketplace, pool, swift-registry, audit, quality)
  • Configuration — .npmrc, ~/.lpm/config.toml, environment variables, --proxy mode
  • Environments & Secrets — the full lpm env surface
  • Tunnels — the full lpm tunnel surface
  • AI & Tools — MCP server, AI metadata, Agent Skills

For everything else — resolver internals, lockfile format, the content-addressable store, the dev server, task runner, test/bench runners, lint and format, the patch system, dependency graph, plugins, the full per-command flag reference — see cli.lpm.dev.

Security

  • Credentials stored in your OS keychain (fallback: AES-256-GCM encrypted file at ~/.lpm/.vault-data/<vault-id>.enc).
  • SHA-512 integrity verification for every package download.
  • Path-traversal protection on all file operations.
  • End-to-end encrypted secrets sync — the lpm.dev server never sees plaintext for env push/pull or platform pushes.
  • Lifecycle scripts are blocked by default; opt in per package with lpm approve-scripts.

Where the CLI lives

The Rust client repository is public at github.com/lpm-dev/rust-client. The full command list with every flag is documented at cli.lpm.dev/docs/commands.